Security Advisory: Multiple Vulnerabilities in Phoenix Contact Routers

Summary

The web administration interface executes an OS command constructed with unsanitized user input.

Impact

A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges.

Description

The web admin interface is written in PHP and has a page allowing for GNSS receiver configuration at

On line 36, the script calls

<?php
require_once('config/config.php');
if (isset($c))
    $device_id = $c;
else
    $device_id = $_REQUEST['device_id'];

$status = "disabled";
define("STATUS_FILENAME", "/tmp/status/gnss". $device_id ."/dr-auto-align");
define("ANGLES_FILENAME", "/tmp/status/gnss". $device_id ."/dr-auto-align-angles");
define("PID_FILENAME", "/run/gnss". $device_id ."/dr-auto-align.pid");

if (file_exists(STATUS_FILENAME)) {
    $statusfile = fopen(STATUS_FILENAME, "r");
    $status = fread($statusfile, filesize(STATUS_FILENAME));
    fclose($statusfile);
}

$yaw = "n/a";
$pitch = "n/a";
$roll = "n/a";
if (file_exists(ANGLES_FILENAME)) {
    $anglesfile = fopen(ANGLES_FILENAME, "r");
    $angles = fread($anglesfile, filesize(ANGLES_FILENAME));
    fclose($anglesfile);

    $angles = explode("\n", $angles);
    $yaw = explode("yaw: ", $angles[0])[1];
    $pitch = explode("pitch: ", $angles[1])[1];
    $roll = explode("roll: ", $angles[2])[1];

}

if (isset($_POST['toggleAlignment'])) {
    if ($status == "disabled") {
        exec("/usr/local/sbin/www-scripts/various/doAutoAlignment " . $device_id . " > /dev/null &");
        $status = "starting";
    }
    else {
        exec("kill $(cat ". PID_FILENAME . ")");
        $status = "stopping";
    }
}

Summary

The web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion.

Impact

By uploading a malicious PHP file within the web administration root directory, an authenticated user could gain unconstrained remote command execution.

Description

The web admin interface is written in PHP and has a page to handle what they call "SDK jobs" at

if (!move_uploaded_file($_FILES["scriptUpload"]["tmp_name"], $uploadpath))

The unsanitized user input is constructed this way:

$name = trim($_POST['scriptName']);
$uploadpath = UPLOAD_DIR . "/" . $name;